Brion Vibber wrote:
Andrew Gray wrote:
Is that "keep recording but ignore
them", or disable in the sense of
turn off logging totally? Just curious...
After a few months of having logs that you're not reading fill up the servers'
hard disks every few days, you turn them off. :)
-- brion vibber (brion @
pobox.com)
How about a cron job that turns logging on, then off, intermittently? Eg.
For example, on each server, have a cron job that does this:
Every 5 mins:
Is logging on?
Then: turn it off
Else: generate a random number
If it's == 0 mod 1000:
Then: turn logging on
Else: do nothing
This way, you get representative short blocks of 5 minutes of traffic,
kicking in once every three days or so on each of the 100 or so servers
at random times of the day or night. This would also suffice for gross
statistical analysis, and wouldn't require any modification of the squid
code, just a short external shell script.
Log-rotation should handle the rest and prevent the disks filling up,
since the average sampling rate would then be low enough to cope with.
-- Neil